Hi,

This post is regarding Command Injection.

Command injection is an attack in which the goal is execution of arbitrary commands on the host operating system via a vulnerable application.

Command injection attacks are possible when an application passes unsafe user supplied data (forms, cookies, HTTP headers etc.) to a system shell.

The syntax and commands may differ between the Operating Systems (OS), such as Linux and Windows, depending on their desired actions.

Modal:

First we need one vulnerable web application. In this tutorial i am working with DVWA web application. If you need DVWA you can download here http://www.dvwa.co.uk/.

I have host the DVWA on windows. So i am working with windows commands. Do watch below video and check example of payloads.

Example of payloads:

127.0.0.1 && dir

127.0.0.1 | dir

127.0.0.1 & calc

127.0.0.1 & mkdir D:\vegabird

Prevention:

We need to sanitize or ban the input which could cause the vulnerability to occur, those are as follows

• &&
• |
• …